Summary
- Three suspected VasyGrek participants have been detained and associated infrastructure reportedly dismantled.
- Kaspersky identified more than 100 attempted attacks during the first nine months of 2026.
- The group's activity has affected industrial, commercial, and government targets, although the total number of successful compromises remains unknown.
Russian police have detained three suspected members of the VasyGrek hacking group and reported dismantling its infrastructure following an investigation into phishing and malware attacks against corporate and government networks.
The group, also known as Fluffy Wolf, has been active since at least 2016. Russian authorities announced the operation on 2 November, identifying a suspected organiser and two alleged accomplices.
The investigation was conducted with assistance from Kaspersky, which has tracked the group’s malware campaigns and targeting activity.
According to the Russian Interior Ministry, the alleged organiser has been placed under house arrest, while the other suspects face travel restrictions during the investigation. The proceedings concern suspected criminal activity involving malicious software and unauthorised access.
Kaspersky separately reported detecting more than 100 attempted VasyGrek attacks during the first nine months of 2026, involving organisations in Russia, Belarus, and Kazakhstan.
Industrial and commercial organisations targeted
The security company’s findings identify metallurgy businesses, wholesale suppliers of raw and industrial materials, and government institutions among the sectors most frequently targeted.
These organisations can hold commercially sensitive records, supplier information, administrative credentials, and operational documents that may be valuable to attackers.
VasyGrek has commonly relied on phishing emails presenting malicious files as ordinary business correspondence, including documents associated with accounting and administrative functions.
Such messages exploit the routine exchange of files between employees, customers, and suppliers. Recipients who trust the apparent business context may open malicious attachments, allowing the attacker to attempt credential theft or establish access to the organisation’s systems.
For industrial businesses, access obtained through office networks can expose information about commercial relationships, procurement, and operations. The effects depend on the permissions of the compromised accounts and the separation between business and operational systems.
Kaspersky’s count concerns detected attempts rather than 100 confirmed successful intrusions. The underlying evidence does not establish how many organisations experienced data theft or subsequent disruption.
The Russian authorities have also not published a complete victim register or detailed account of the systems seized during the enforcement action.
A longstanding operation faces disruption
The police investigation follows years of activity associated with the group. During that period, VasyGrek reportedly adjusted its tools and delivery methods while retaining a preference for corporate targets.
Its apparent longevity indicates that the alleged operators maintained the resources needed to distribute malware and pursue new victims across successive campaigns.
Police say they identified the suspects and disrupted the infrastructure supporting the activity. The announcement establishes an enforcement action against the named group, although the extent of the disruption has not been independently verified.
Even when servers and computers are seized, credentials obtained in earlier intrusions may remain outside the authorities’ control. Previously distributed malware can also persist on affected systems until organisations identify and remove it.
The arrests therefore cannot be treated as proof that every consequence of the operation has been eliminated.
Cooperation between investigators and a security research company may help connect individual malware incidents to a broader criminal network. Researchers can identify recurring technical characteristics and targeting patterns, while law enforcement authorities can obtain evidence through investigative powers.
However, identifying a common malware family does not alone prove the identity or guilt of the people alleged to have operated it.
Cross-border activity and enforcement
Although much of the group’s documented targeting has centred on Russia, Kaspersky’s findings include activity in Belarus and Kazakhstan. The Interior Ministry has also referred to attacks involving foreign companies without publishing a detailed geographic breakdown.
Those reports establish a cross-border dimension, but the available information does not demonstrate a substantial campaign against UK or EU organisations.
The case nevertheless concerns infrastructure supporting corporate phishing and malware activity across multiple jurisdictions, together with the difficulties of linking such attacks to identifiable operators.
Further court proceedings may provide more information about the suspected participants, the infrastructure seized, and the number of organisations affected.
For now, Russian authorities have reported three detentions and the disruption of VasyGrek’s infrastructure, while the criminal allegations remain subject to investigation.
